CVE-2026-76256
Information Exposure through REST API Endpoints in Splunk Secure Gateway
MEDIUM 4.3
En bref
- Source
- NVD
- EPSS
- EPSS 0.30 % · centile 23 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- cisco
- Statut NVD
- Analyzed
Description
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, a user who does not hold the "admin" or "power" Splunk roles could read sensitive Security Assertion Markup Language setup and instance settings information through Splunk Secure Gateway Representational State Transfer (REST) API endpoints. The vulnerability is possible because the affected Security Assertion Markup Language setup and instance settings REST API endpoints do not enforce authorization requirements before returning configuration information.
Faiblesses (CWE)
- CWE-200 — Exposition d'informations sensibles à un acteur non autorisé
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N | cisco |
| CVSS 3.1 | MEDIUM 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N | NVD · psirt@cisco.com (Secondary) |
Références européennes
- ENISA EUVD · EUVD-2026-63108
- GCVE · GCVE-0-2026-76256
Avis du CERT-FR
- CERTFR-2026-AVI-1056 — Multiples vulnérabilités dans les produits Splunk · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*≥ 9.4.0 < 9.4.14cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*≥ 10.0.0 < 10.0.9cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*≥ 10.2.0 < 10.2.6cpe:2.3:a:splunk:splunk:*:*:*:*:enterprise:*:*:*≥ 10.4.0 < 10.4.2cpe:2.3:a:splunk:splunk_secure_gateway:*:*:*:*:*:*:*:*≥ 3.8.0 < 3.8.70cpe:2.3:a:splunk:splunk_secure_gateway:*:*:*:*:*:*:*:*≥ 3.9.0 < 3.9.23cpe:2.3:a:splunk:splunk_secure_gateway:*:*:*:*:*:*:*:*≥ 3.10.0 < 3.10.9
Produits affectés
| Produit | Versions |
|---|---|
| Splunk · Splunk Enterprise | affected 10.4 < 10.4.2 ; affected 10.2 < 10.2.6 ; affected 10.0 < 10.0.9 ; affected 9.4 < 9.4.14 |
| Splunk · Splunk Secure Gateway | affected 3.10 < 3.10.9 ; affected 3.9 < 3.9.23 ; affected 3.8 < 3.8.70 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |